## Annex B - DCMS IMA Action Plan

1. Department for Culture, Media and Sport (DCMS) should continue to improve its approach to information risk and information asset management.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 1.1 Identifying risks that reflect the potential impact of not capturing and keeping information appropriately – both in terms of limitations of the Google environment and cultural factors – and risks around the loss of digital continuity and usability of information. Ensure that these are documented and owned at an appropriate level to drive action. | DRO | ● To work with DCMS IT lead on developing the Information Asset Register (IAR) to understand the extent to which information is stored outside of Google Drive and to ensure that there are appropriate digital arrangements set out in the IAR.\
● To liaise with OGDs (including Cabinet Office) that use the G-Suite to understand the processes Departments have in place to mitigate the risks of not capturing information effectively. | March 2018 | Active | | ● 1.2 Learn from departments which have well defined information and records management risks. | DRO | ● DRO met with MoJ and HO as they have been identified by TNA as demonstrating good practice in this area and feedback recommendations to KIMIT.\
● Further meetings were conducted with Northern Ireland Office and HM Treasury as a similar sized department. | December 2017 | Active | | ● 1.3 Arrange a board briefing from The National Archives on information assurance and risk to help increase awareness at a senior level. | DRO | ● To recommend to KIMIT at its July meeting that it (or EB as appropriate) receive a briefing on Information Assurance.\
● To be part of CE/Keeper – PS meeting on 18 Dec 17 (Rescheduled for 9 Jan 18) | December 17 | Active | | | 1.4 Increase awareness of the Information Asset Owner (IAO) role across the department, among those that hold the IAO role and DCMS staff more generally. | DRO | • Meetings and training sessions with Information Asset Owners (IAO) in each business area are ongoing and being updated to cover DP Bill compliance work.\
• Liaison with internal Comms Team to refresh key KIM areas on the intranet for Information Assurance and Data Protection guidance. | March 2018 | Active | | | | | | | | | | 1.5 Ensure that IAOs are appointed at an appropriate level and have a clear idea of their responsibilities. | DRO | • Organisational chart show DCMS SCS staff are aware of their responsibilities but staff education is an ongoing task as an IAO must consider which Information Assets it needs to record in the IAR, what has business value and where personal data is held. | December 2017 | Active | | | | | | | | | | 1.6 Produce guidance and training to support IAOs in their role and using The National Archives’ ‘Train the Trainer’ materials to help with this. | DRO | • IAO guidance including a job description and guidance on completing the IAR has been produced and recently updated. Further updates will continue to reflect changes for the DP Bill compliance. This will be published internally and continuous updates as the department progresses towards DP Bill compliance in May 18 to ensure it meets the requirements of GDPR. | March 2018 | Complete | | | | | | | | | | 1.7 Develop an approach to identify and record information assets that is proportionate and enables DCMS to get oversight of these assets, in particular those that are sensitive or of high value (explore good practice with OGDs). | DRO | • As at 1.6 the guidance on IAR including a definition of an Information Asset and the role of IAO is completed.\
• The profile of Information Assurance is being raised. The training sessions with IAOs and publication of this guidance on the intranet will help to address this. | December 2017 | Active | | | | | | | | | | 1.8 Explore good practice in information asset governance in other government departments. | DRO | • DRO to arrange meetings with DWP to understand its Information Asset governance | December 2017 | Active | arrangements as held up by TNA as an exemplar of good practice.

2. DCMS should continue work to promote and maintain a good culture of information and records management across the department.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 2.1 Use KIMIT and the Records Management, IT and Knowledge Strategies to drive work on improving information and records management culture. | DRO | ● The DRO continues to liaise with OGDs that use the G-Suite (and AODocs) to ensure that the Department’s Records Management policy is aligned, learning and contributing to best practice. The updated policy was submitted to KIMIT for consideration at its October meeting and agreed. | Ongoing | Active | | ● 2.2 Update the records management policy and associated guidance, ensuring that it clearly sets out the responsibilities of staff for managing their information and records within the new IT environment. | DRO | ● To liaise with HR and the SCS Knowledge Champion to map the best way of inducting staff to the department in terms of their information obligations. ● Thereafter to develop training, guidance as appropriate, other solution as appropriate. | March 2018 | Active | | ● 2.3 Incorporate information and records management as part of the Management Framework to encourage managers to promote and drive good practice. | DRO | ● The DRO has established a schedule of new teams to brief on Information Asset obligations, AODocs library structure | Ongoing | Active | | | | | |---|---|---| | | | management and appointment of Knowledge Champions.\
| | | ● A continuing process of information assurance as well as good records management education continues.\
| | | | | ● 2.4 Work with business areas to ensure that information and records management is included as part of induction for new staff. | DRO | ● Arrange meetings with the Houses of Parliament and Home Office who have produced e-learning courses to introduce staff to their information and records management responsibilities.\
| | | ● Develop a solution appropriate to DCMS.\
| | | Ongoing\
| | | Active | | ● 2.5 Build on the work DCMS is already doing to provide training for staff in information and records management. This could include e-learning. | DRO | ● To work with DCMS IT lead and Comms team to consider developing some form of online training (induction) package for staff. Further promote AODocs online training videos.\
| | | ● Induction continues to mature within DCMS, with both records and information security featuring as part of the induction pack.\
| | | March 2018\
| | | Active | | ● 2.6 Explore and adopt cross government toolkit (available on the Knowledge Hub) to improve departmental culture. | DRO | ● The DRO utilises the cross government toolkit and relevant components to enhance DCMS records and information culture as appropriate.\
| | | Ongoing\
| | | Active | | ● 2.7 Promote the Knowledge and Information Management (KIM) message to mitigate risks that arise from machinery of government change and changes in personnel. | SCS Knowledge Champion | ● To further develop the Department’s KIM maturity through the delivery of the Department’s Knowledge Management Strategy (early 2018) and thereafter through the work of the business unit level Knowledge Management Champions network.\
| | | ● A new SCS KIM Champion is now firmly in place to take this initiative forward.\
| | | March 2018\
| | | Active | | | 2.8 Engage with new teams to ensure information management requirements are identified from the outset. | DRO | 2.9 Highlight the importance of information from an historic and business point of view in order for it to resonate with staff. A good example is HM Treasury creating videos for its intranet on the history of its records. | DRO | 2.10 Identify a means to engage all SCS staff – not just those that are members of the KIMIT. | DRO | |---|---|---|---|---|---|---| | | Meet with new Deputy Directors to explain their roles as IAOs and to arrange separate records management briefings at team meetings. (Aligned with 1.4) | Ongoing | DCMS Operational Selection Policy (OSP) has passed through TNA assessment and has been published for comment by the wider academic community. It acts as the definitive guide (resource) to the department’s work since its creation from the Department of National Heritage in 1992. To publish a series of blogs on departmental records that have been selected for preservation (as the transfer programme matures and records of archival value continue to be selected for preservation). | December 2017 | This action will form part of work to engage with SCS members about their roles as IAOs. | Ongoing | | | Ongoing | Active | Active | Active | Active | Active | DCMS needs to ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 3.1 Ensure that requirements around information and records management form a core part of work to review and define the service provided by Cabinet Office as IT provider. | DCMS IT Lead and DRO | ● Monthly alignment meetings with THE DCMS IT lead established. Records requirements now embedded in the IT Programme and an integral part of the new IT Strategy for 2018.\
● Meetings already established with Cabinet Office DRO to understand the latest progress with information and records management in that department. | Ongoing | Active | | ● 3.2 Work with Cabinet Office and outside companies such as AODocs to address gaps in the Google environment, in particular around retention and disposal and the management of email. | | ● DRO has begun work on a ‘Records Lifecycle Management in DCMS’ policy document and is working with TNA and Cabinet Office to develop this policy.\
● The DRO is a member of the cross government Google Group which discusses desired enhancements to G-Suite. | Ongoing | Active | | Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 3.3 Keep pace with developments and sharing its own knowledge and experience of the tools as part of the cross-government Google working group. | DRO | ● The DRO is a member of the cross government Google Group which discusses desired enhancements to G-Suite. | Ongoing | Active | | ● 3.4 Support staff to ensure that they are using the right systems for the right purpose and in the right way through policies, guidance and training. | DRO | ● DRO has established a series of briefings on current suite of guidance on records and information management with the Knowledge Champions Network, looking to address where it is felt there are gaps for users. (The Records Management Policy will also be updated). | Ongoing | Active | | ● 3.5 Consider methods to discourage the use of hard drives such as size limits or auto deletion after a certain period of time. | | ● The DRO will liaise with OGDs to understand their approach to this area and make a recommendation to KIMIT. ● DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. | March 2018 | Active | | ● 3.6 Factor in information and records management requirements as part of the IT procurement process as standard and ensuring that the Departmental Records Officer has a ‘line in’ to this. | DCMS IT Lead and DCMS DRO | ● The DCMS DRO and IT Lead will arrange to have a monthly catch up and ensure that where system changes take place there is a joined up approach (this has already been | March 2018 | Active | | 3.7 Gain an oversight of systems and applications that are in use and identifying key information and records management risks. | DRO and DCMS IT Lead | The further development of the IAR should ensure that standalone Departmental systems are captured on the IAR and information risks understood and controlled by IAOs. | Ongoing | Active | | 3.8 Develop a plan to reduce the legacy digital information from Livelink including establishing what is held, identifying information of business and historical value. | DRO and DCMS IT Lead | The DRO and IT lead are working together with TNA to map out DCMS’s digital records holdings both to understand the Department’s Public Records obligations in this area and also to establish a solution for the remaining data held in Livelink. DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. | March 2018 | Active | | 3.9 Clarify whether information from legacy shared drives was migrated to Google. | DRO and DCMS IT Lead | DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. | March 2018 | Active | DCMS should continue to develop and support its KIM team governance and team structures and the service that it provides to the business.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 4.1 Provide senior management support to the DRO, ensuring that he and his team are equipped to discharge functions around information and records management and information assurance, in particular any legislative obligations (for example, Public Records Act, Data Protection). | KIMIT DRO | ● The DRO will undertake a benchmarking study to compare records and information management resourcing in DCMS with OGDs.\
● The DRO will include in this paper a recommendation on the resource allocation required to ensure that the core Department can deliver against its legislative information obligations and business needs in terms of information management. | December 2017 | Active | | ● 4.2 Define the level of service that will be provided from the central KIM team and how key aspects such as outreach, monitoring and driving improvement will be delivered. | DRO | ● The extent to which certain areas of work are taken forward will be dependent on the resource allocation discussed above. | December 2017 | Active | | ● 4.3 Ensure that all Knowledge Champions are clear on what their | | | February 2018 | Active | responsibilities are and that the importance of these duties is recognised by their line managers.

| SCS Knowledge Champion | To draft a job description for the Knowledge Champions and to circulate to Deputy Directors across the Department.\
| The KIM Strategy is due in draft in time for the next KIMIT committee in Feb 18 |

| DRO | To liaise with KIM Leaders across government to understand how business unit level compliance is monitored across their organisations. |

| March 2018 | Active |

- 4.4 Consider how best to monitor compliance and raise capability with information and records management out in the business in a way that is proportionate for a relatively small department like DCMS. DCMS needs to continue to maintain its progress in appraisal and selecting and transferring paper records in accordance with the Public Records Act and 20 Year Rule.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 5.1 Continue to allocate appropriate resource for the appraisal, selection, sensitivity review, disposal and transfer of paper records. | DRO | ● Resource continues to be allocated to the outsourced records management service provided by DCLG with the first batch of records transferred to TNA and record destructions completed. DCMS will provide an update to ACNRA on 17 July.\
● DCLG now has 2 full time staff working for DCMS conducting micro and macro appraisal and transfer to TNA.\
● The department is confident to be fully compliant with the 20 Year rule by Dec 18. | Ongoing | Active | | ● 5.2 Consider how the process of sensitivity review (including use of FOI exemptions, redaction and closure applications) may need to change as DCLG and DCMS move to review more recent records which are likely to contain more sensitive information. | DRO | ● The DRO meets with DCLG every three weeks to discuss progress with record review and the end to end transfer and selection process. Quality checks are conducted on DCLG sensitivity review work. The quality assurance regime is set out in a Departmental policy on physical record transfer which has been signed off by KIMIT. | Ongoing | Active | DCMS needs to develop a process for the appraisal, selection, transfer and sensitivity review of its digital information.

Initial DRO commentary post IMA on the starting point with each action area.

Commentary last updated: December 2017

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-----------------------------|-------|------------------------|----------------|--------| | ● 6.1 Survey the digital information that DCMS holds across all its systems (including age, format and subject matter) in order to build up a complete picture of its digital holdings. Use this to identify records that are at risk or due for digital review and transfer. | DRO and DCMS IT Lead | ● The DRO and IT lead are working together with TNA to map out DCMS’s digital records holdings both to understand the Department’s Public Records obligations in this area and also to establish a solution for the remaining data held in Livelink. Recommendation to KIMIT on Livelink by March 2018. ● DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level, as are TNA. | March 2018 | Active | | ● 6.2 Explore and trial methods of digital appraisal and selection (including the use of analytical tools), drawing on advice and guidance from The National Archives and learning from the experience of other government departments in this area. | DRO and DCMS IT Lead | ● The DRO will liaise with MoJ to understand the approach that they have taken to the appraisal of Digital Records. ● The DRO is working closely with his counterpart in Cabinet Office to understand the approach taken by an OGD using the G-suite and is now engaged in the BI4BG | Ongoing. | Active | programme, which will directly address this challenge.

| Enabling/supporting actions | Owner | Commentary on progress | Completion due | Status | |-------------------------------------------------------------------------------------------|-------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|--------| | ● 6.3 Ensure that knowledge of DCMS functions and records gathered through the existing paper review process are used to inform digital appraisal where possible. | DRO | ● The finalisation of the Operational Selection Policy (OSP) will go some way to ensuring that there is documented evidence of the key pieces of work and events since the formation of the Department in 1992.\
● The workshops that will be undertaken between TNA and DCMS to map the Department’s digital record holdings over time will assist with further developing a corporate understanding of its digital record landscape.\
● DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. | Ongoing | Active | | ● 6.4 Engage with cross government work around the sensitivity review of digital information (including the use of analytical tools) and considering how these methods can be applied to digital records held at DCMS. | DRO | ● The DRO is engaged with the Cross Government: Records Management Project, Google Group, KIM Leaders and has completed the Digital continuity and Digital Transfer training. | Ongoing | Active | | ● 6.5 Work with Cabinet Office and The National Archives on the transfer of | DRO | ● It was agreed with TNA in June 2017 that DCMS would in the first instance produce a Digital Continuity plan for the ODA records | December 2017 | Active | | significant digital records such as those of the Olympic Delivery Authority. | before developing an approach to their transfer to TNA at the appropriate time.

- DCMS is a key stakeholder on the Better Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. |